Critical SonicWall firewall patch not released for all devices

Security hardware manufacturer SonicWall has fixed a critical vulnerability in the SonicOS security operating system that allows denial of service (DoS) attacks and could lead to remote code execution (RCE).

The security flaw is a stack-based buffer overflow weakness with a 9.4 CVSS severity score and impacting multiple SonicWall firewalls.

Tracked as CVE-2022-22274, the bug affects TZ Series entry-level desktop form factor next-generation firewalls (NGFW) for small- and medium-sized businesses (SMBs), Network Security Virtual (NSv series) firewalls designed to secure the cloud, and Network Security services platform (NSsp) high-end firewalls.

Exploitable remotely without authentication

Unauthenticated attackers can exploit the flaw remotely, via HTTP requests, in low complexity attacks that don't require user interaction "to cause Denial of Service (DoS) or potentially results in code execution in the firewall."

The SonicWall Product Security Incident Response Team (PSIRT) says there are no reports of public proof-of-concept (PoC) exploits, and it found no evidence of exploitation in attacks.

The company has released patches and hotfixes for all impacted SonicOS versions and firewalls and urged customers to update all affected products.

"SonicWall strongly urges organizations using impacted SonicWall firewalls listed below to follow the provided guidance," the company said in a security advisory published on Friday.

Product	Impacted Platforms	Impacted Version	Fixed Version
SonicWall FireWalls	TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, Nsv 270, NSv 470, NSv 870	7.0.1-5050 and earlier	7.0.1-5051 and higher
SonicWall NSsp Firewall	NSsp 15700	7.0.1-R579 and earlier	Mid-April (Hotfix build 7.0.1-5030-HF-R844)
SonicWall NSv Firewalls	NSv 10, NSv 25, NSv 50, Nsv 100, NSv 200, Nsv, 300, NSv 400, NSv 800, NSv 1600	6.5.4.4-44v-21-1452 and earlier	6.5.4.4-44v-21-1519 and higher

NSsp 15700 firewall gets hotfix, full patch in April

The only affected firewall still waiting for a patch against CVE-2022-22274 is the NSsp 15700 enterprise-class high-speed firewall.

While a hotfix is already available for those reaching out to the support team, SonicWall estimates that a full patch to block potential attacks targeting this firewall will be released in roughly two weeks.

"For NSsp 15700, continue with the temporary mitigation to avoid exploitation or reach out to the SonicWall support team who can provide you with a hotfix firmware (7.0.1-5030-HF-R844)," the company explained.

"SonicWall expects an official firmware version with necessary patches for NSsp15700 to be available in mid-April 2022."

Temporary workaround available

SonicWall also provides a temporary workaround to remove the exploitation vector on systems that cannot be immediately patched.

As the security vendor explained, admins are required to only allow access to the SonicOS management interface to trusted sources.

"Until the [..] patches can be applied, SonicWall PSIRT strongly recommends that administrators limit SonicOS management access to trusted sources (and/or disable management access from untrusted internet sources) by modifying the existing SonicOS Management access rules (SSH/HTTPS/HTTP Management)," SonicWall added.

The updated access rules will ensure that the impacted devices "only allow management access from trusted source IP addresses."

The company's support website also provides customers with more information on how to restrict admin access and tips on when to allow access to the firewalls' web management interface.

"SonicWall has proactively communicated mitigation guidance to any impacted organizations," the security vendor told BleepingComputer.